US20160026787A1 - Authenticating messages sent over a vehicle bus that include message authentication codes - Google Patents

Abstract

A system and method of transmitting data within a vehicle over a vehicle bus includes: constructing at an electronic control unit (ECU) a serial bus message that includes a data message and a message authentication code (MAC) that is created using a secret key stored at the ECU, a MAC algorithm, and the data message; transmitting the serial bus message to a receiving ECU over the vehicle bus; and authenticating the serial bus message at the receiving ECU using a copy of the secret key stored at the receiving ECU by creating a copy of the MAC from the data message included in the serial bus message, the copy of the secret key, and the MAC algorithm; comparing the MAC included in the serial bus message with the copy of the MAC created at the receiving ECU; and rejecting or accepting the data message based on the comparison.

Description

TECHNICAL FIELD
• The present invention relates to data messages sent over a vehicle bus and, more particularly, to authenticating the data messages using message authentication codes (MACs).
BACKGROUND
• Vehicles include a variety of systems that are used to operate the vehicle. In general, each vehicle system may be directed to a different aspect of vehicle operation. For example, the vehicle can include an engine and transmission to power the vehicle, a power steering system for vehicle control, and a braking system to slow or stop the vehicle, to name just a few vehicle functions. Individual vehicle systems can be assigned to execute the propulsion, control, and braking functions of the vehicle—as well as other, different vehicle functions.
• The vehicle systems are often controlled at the direction of electronic control units (ECUs) that are each communicatively connected to each other by a vehicle communications bus as well as to the vehicle systems. As part of directing their respective vehicle systems, the ECUs can exchange information over the vehicle bus in the form of serial bus messages. It is important that the messages transmitted over the bus are accurate so that the ECU receiving the message can respond accurately and appropriately. In the past, the messages sent over the vehicle bus have been sent with a checksum that can indicate to the ECU receiving the message whether or not the message has been unintentionally corrupted. But use of a checksum may not ensure the integrity of messages against efforts to intentionally alter the contents of messages. As a result, use of techniques other than a checksum for verifying the integrity of intra-vehicle messages could be beneficial to protect those messages against corruption of data that is either intentional or unintentional. Furthermore, the payload for data on a serial bus message is limited. Including the checksum in the payload of the serial bus message can consume space that could be used to communicate additional information in the data message.
SUMMARY
• According to an embodiment of the invention, there is provided a method of transmitting data within a vehicle over a vehicle bus. The method includes constructing at an electronic control unit (ECU) a serial bus message that includes a data message and a message authentication code (MAC) that is created using a secret key stored at the ECU, a MAC algorithm, and the data message; transmitting the serial bus message to a receiving ECU over the vehicle bus; and authenticating the serial bus message at the receiving ECU using a copy of the secret key stored at the receiving ECU by: creating a copy of the MAC from the data message included in the serial bus message, the copy of the secret key, and the MAC algorithm; comparing the MAC included in the serial bus message with the copy of the MAC created at the receiving ECU; and rejecting or accepting the data message based on the comparison.
• According to another embodiment of the invention, there is provided an electronic control unit (ECU) for transmitting data within a vehicle over a vehicle bus. The ECU includes a microprocessor that executes one or more computer-readable instructions; a memory device communicatively coupled with the microprocessor such that the memory device can receive requests from the microprocessor for data stored at the memory device; an input/output port for sending and receiving data over a vehicle bus; a secret key stored in the memory device; and a message authentication code (MAC) algorithm stored at the memory device, wherein the microprocessor creates a serial bus message and includes a data message with the serial bus message along with a message authentication code (MAC) that is created using the data message, the secret key, and the MAC algorithm
BRIEF DESCRIPTION OF THE DRAWINGS
• One or more embodiments of the invention will hereinafter be described in conjunction with the appended drawings, wherein like designations denote like elements, and wherein:
• FIG. 1 is a block diagram depicting an embodiment of a vehicle that is capable of utilizing the method disclosed herein; and
• FIG. 2 is a flow chart depicting an embodiment of a method of transmitting data within a vehicle over a vehicle bus.
DETAILED DESCRIPTION OF THE ILLUSTRATED EMBODIMENTS
• The system and method described below transmits data within a vehicle over a vehicle bus using serial bus messages that are verified using a message authentication code (MAC). Electronic control units (ECU) that transmit or receive serial bus messages over the vehicle bus can each store a copy of a secret key that is used to create or re-create a MAC using the data message sent with the serial bus messages. When an ECU sends a serial bus message over the vehicle bus, the ECU can include with the serial bus message a MAC that is used to verify that the included data message is trustworthy and correct. The ECU can generate a MAC using a MAC algorithm, which is a function of the data to be sent, the secret key, and the data message. Example MAC algorithms include a hash-based message authentication code (HMAC) algorithm and a block cipher-based message authentication code (CMAC) algorithm. The ECU can create the MAC by inputting the secret key and the data message into the MAC algorithm to create a MAC for the serial bus message to be sent. The ECU can then include the created MAC and the data message with the serial bus message and transmit the serial bus message to its destination.
• When the serial bus message is received at another ECU, the MAC can be verified using the data message included in the serial bus message, a copy of the secret key stored at the receiving ECU, and the MAC algorithm. The received data message can be entered along with the copy of the secret key into a MAC algorithm stored at the receiving ECU to create a copy of the MAC that can be used to verify the data message. The data message is authentic when the copy of the MAC created using the copy of the secret key and the received data message matches the MAC included with the serial bus message. If the copy of the MAC does not match the MAC included with the received serial bus message, then the message can be ignored. The use of the MAC can be helpful when communicating serial bus messages that are of high importance or messages that can benefit from a high accuracy rate. Also, including the MAC with the serial bus message permits serial bus messages that omit a checksum or CRC. Nonetheless, the MAC is larger than the CRC when measured as the number of bits they consume.
• With reference toFIG. 1, there is shown avehicle10 that includesvehicle electronics12 used to directvehicle systems14. Thevehicle10 is depicted in the illustrated embodiment as a passenger car, but it should be appreciated that any other vehicle including motorcycles, trucks, sports utility vehicles (SUVs), recreational vehicles (RVs), marine vessels, aircraft, etc., can also be used. Thevehicle electronics12 andvehicle systems14 shown inFIG. 1 include an exemplary arrangement of electronic control units (ECUs) that are communicatively connected via avehicle bus16.
• Thevehicle electronics12 can include electronic control units (ECUs) in the form of electronic hardware components that are located throughout thevehicle10 and typically receive input from one or more sensors and use the sensed input to perform diagnostic, monitoring, control, reporting and/or other functions. Each of the ECUs is preferably connected by thevehicle bus16 to the other ECUs and can be programmed to run vehicle systems. Thevehicle bus16 can be implemented using a variety of suitable network connections, such as a controller area network (CAN), a media oriented system transfer (MOST), a local interconnection network (LIN), a local area network (LAN)—both wireless and wired, and other appropriate connections such as Ethernet or others that conform with known ISO, SAE and IEEE standards and specifications, to name but a few. The ECUs using thevehicle bus16 and shown as part of thevehicle electronics12 orvehicle systems14 generally include a microprocessor, a non-volatile memory device that stores computer-readable instructions, and an input/output (I/O) that the ECU uses to communicate over thevehicle bus16. These components can be varied somewhat based on the particular vehicle systems the ECU may control as well as the type ofvehicle bus16 used. The sophistication and processing power of the microprocessor, the amount of I/O, and complexity of the computer-readable instructions or software can be increased or decreased based on the vehicle function.
• The microprocessor can be any type of device capable of processing electronic instructions including microcontrollers, host processors, controllers, vehicle communication processors, and application specific integrated circuits (ASICs). The microprocessor executes various types of digitally-stored instructions, such as software or firmware programs stored in the memory device. For instance, the microprocessor can execute programs or process data to carry out at least a part of the method discussed herein. The memory device can be implemented using known types of random access memory (RAM) or electronically-erasable programmable read-only memory (EEPROMs) while the I/O can be implemented using a controller, such as an Ethernet controller or a CAN controller depending on the type ofvehicle bus16 that is used. In that sense, the ECUs can include hardware that conforms to a particular type ofvehicle bus16 used at thevehicle12. For example, ECUs communicating using a CAN bus can include a microprocessor, a CAN controller, and an I/O unit in the form of a transceiver that sends and receives serial bus messages in the form of signals over thevehicle bus16.
• The serial bus messages transmitted over thevehicle bus16 include message authentication codes (MACs) but lack a checksum or CRC. Serial bus messages can include any of several message parts, such as a header, a footer, a rolling count (RC), or a payload while omitting the checksum or CRC. Rather than including the checksum, the message payload of the serial bus message can include the MAC along with a data message. Generally speaking, the data message can comprise a computer-readable instruction that is sent from an ECU and provides direction to another ECU or vehicle function.
• The ECUs shown inFIG. 1 include a body control module (BCM)18, an electronic braking control module (EBCM)20, a transmission control module (TCM)22, and an engine control module (ECM)24. Broadly speaking, the BCM18 can govern various components located throughout thevehicle10 that carry outvehicle functions14, such as avehicle braking system26 or the vehicle'spower door locks28, each of which can receive serial bus messages using an ECU. As part of the controlling thebraking system26, the BCM18 can detect a position of the accelerator/brake pedal of thevehicle10. The TCM22 can regulate operation of one or more components of avehicle transmission30 while the ECM24 can control various operational aspects of avehicle engine32, such as fuel ignition and ignition timing. Thevehicle transmission30 and thevehicle engine32 can each include an ECU of their own that receives serial bus messages. As is appreciated by those skilled in the art, the above-mentioned ECUs are only examples of some of the implementations that may be used invehicle10, as numerous others are also possible. It should be understood that the disclosed method can be used with any number of ECUs or different vehicle systems and is not specifically limited to the vehicle electronics and systems shown here. Also, the architecture, construction, setup, and operation of thevehicle10 and its individual components are generally known in the art. Thus, the following paragraphs simply provide a brief overview of onevehicle10; however, other configurations of vehicles, vehicle systems, or vehicle electronics not shown here could employ the disclosed method as well.
• Turning now toFIG. 2, there is shown an exemplary implementation of amethod200 of transmitting data within thevehicle10 over thevehicle bus16 that begins atstep210 by constructing, at an electronic control unit (ECU), a serial bus message that includes a payload comprising a data message and a message authentication code (MAC). Each ECU can create a MAC and include the MAC with a serial bus message the ECU sends over thevehicle bus16. The MAC can be created by inputting a secret key into a MAC algorithm along with the data message. The resulting MAC can then be included in the payload of the serial bus message. The length of the MAC as measured in bits can be variable but in one embodiment the MAC length can be specified to be greater than 30 bits.
• In one example, theBCM18 can detect the position of a brake pedal and generate a serial bus message including a MAC and a data message that instructs an ECU used by thebraking system26 to alter the braking force used at thevehicle10. Another example could involve theECM24 determining that the vehicle engine has reached an RPM limit and generating a serial bus message directing the vehicle transmission to shift into a higher gear. The serial bus message generated by theECM24 can include the instruction to shift gears in the data message and use both the secret key and the data message to create a MAC for inclusion in the payload of the serial bus message. The serial bus message can then be transmitted from theECM24 to theTCM22 or alternatively thevehicle transmission30 directly. Themethod200 proceeds to step220.
• Atstep220, the serial bus message is transmitted to a receiving ECU over thevehicle bus16. After generating the serial bus message that includes the MAC, the ECU can transmit the message over thevehicle bus16 to another ECU. The ECU receiving the serial bus message can then be authenticated before instructions or information included in the data message of the serial bus message is acted on. Continuing the examples discussed above, theBCM18 can transmit the serial bus message including the MAC to an ECU at thebraking system26. And theECM24 can send the generated serial bus message including the MAC to an ECU at theTCM22. Themethod200 proceeds to step230.
• Atstep230, the serial bus message is authenticated at the receiving ECU using a copy of the secret key stored at the receiving ECU. When a serial bus message is received, the MAC included with the message can be verified using the data message of the serial bus message and the copy of the secret key. The receiving ECU can create a copy of the MAC using the data message included in the payload of the serial bus message. The MAC copy can be calculated by entering the data message from the received serial bus message and the copy of the secret key into the MAC algorithm. Both the copy of the secret key and the MAC algorithm can be stored at the receiving ECU. The ECU can then compare the calculated copy of the MAC with the MAC included in the payload of the serial bus message. The receiving ECU can reject or accept the data message included in the received serial bus message based on the comparison. If the calculated copy of the MAC matches the MAC included in the received serial bus message, the receiving ECU can determine that the data message is accurate and has not been either intentionally or unintentionally corrupted or altered. The receiving ECU can then act on the instructions included in the data message. However, if the calculated copy of the MAC does not match the MAC included in the received serial bus message, the receiving ECU can determine that the data message has been corrupted—either intentionally or unintentionally.
• Advancing the examples introduced above, the serial bus message including a MAC and a data message that instructs an ECU used by thebraking system26 to alter the braking force used at thevehicle10 can be verified at an ECU used by thebraking system26. The receiving ECU at thebraking system26 can use a copy of the secret key and MAC algorithm to create a copy of the MAC included with serial bus message. By entering the data message representing the instruction to alter braking force and the secret key into the MAC algorithm, the receiving ECU at thebraking system26 can create the copy MAC to compare with the received MAC. If the MAC copy matches the received MAC, thevehicle braking system26 can act on the instruction to alter braking force; otherwise, the instruction can be ignored. With respect to the other example, theTCM22 can receive the serial bus message directing the vehicle transmission to shift into a higher gear and verify the message using the included MAC and data message. An ECU at theTCM22 can create a MAC copy by entering the data message portion of the received serial bus message that directs the transmission to shift along with a copy of the secret key into the MAC algorithm. If the MAC copy matches the received MAC, theTCM22 can determine that the instruction to shift gears is correct and not corrupted either intentionally or unintentionally. However, if the MAC copy does not match the received MAC, theTCM22 can ignore the message to shift. TheTCM22 can then create a serial bus message instructing the transmission to change gears and include with the message a MAC. The serial bus message can then be sent to an ECU at thevehicle transmission30 and authenticated as discussed above.
• It is to be understood that the foregoing is a description of one or more embodiments of the invention. The invention is not limited to the particular embodiment(s) disclosed herein, but rather is defined solely by the claims below. Furthermore, the statements contained in the foregoing description relate to particular embodiments and are not to be construed as limitations on the scope of the invention or on the definition of terms used in the claims, except where a term or phrase is expressly defined above. Various other embodiments and various changes and modifications to the disclosed embodiment(s) will become apparent to those skilled in the art. All such other embodiments, changes, and modifications are intended to come within the scope of the appended claims.
• As used in this specification and claims, the terms “e.g.,” “for example,” “for instance,” “such as,” and “like,” and the verbs “comprising,” “having,” “including,” and their other verb forms, when used in conjunction with a listing of one or more components or other items, are each to be construed as open-ended, meaning that the listing is not to be considered as excluding other, additional components or items. Other terms are to be construed using their broadest reasonable meaning unless they are used in a context that requires a different interpretation.

Claims (10)

1. A method of transmitting data within a vehicle over a vehicle bus, comprising the steps of:

(a) constructing at an electronic control unit (ECU) a serial bus message that includes a data message and a message authentication code (MAC) that is created using a secret key stored at the ECU, a MAC algorithm, and the data message;

(b) transmitting the serial bus message to a receiving ECU over the vehicle bus;

(c) authenticating the serial bus message at the receiving ECU using a copy of the secret key stored at the receiving ECU by:

(c1) creating a copy of the MAC from the data message included in the serial bus message, the copy of the secret key, and the MAC algorithm;

(c2) comparing the MAC included in the serial bus message with the copy of the MAC created at the receiving ECU; and

(c3) rejecting or accepting the data message based on the comparison in step (c2).

2. The method ofclaim 1, wherein a length of the MAC is greater than 30 bits.

3. The method ofclaim 1, wherein the vehicle bus is a controller area network (CAN) bus, a media oriented system transfer (MOST) bus, or a local area network (LAN).

4. The method ofclaim 1, further comprising the step of including the MAC in a payload of the serial bus message.

5. The method ofclaim 1, wherein the ECU controls one or more vehicle systems.

6. A electronic control unit (ECU) for transmitting data within a vehicle over a vehicle bus, comprising:

a microprocessor that executes one or more computer-readable instructions;

a memory device communicatively coupled with the microprocessor such that the memory device can receive requests from the microprocessor for data stored at the memory device;

an input/output port for sending and receiving data over a vehicle bus;

a secret key stored in the memory device; and

a message authentication code (MAC) algorithm stored at the memory device, wherein the microprocessor creates a serial bus message and includes a data message with the serial bus message along with a message authentication code (MAC) that is created using the data message, the secret key, and the MAC algorithm.

7. The ECU ofclaim 6, wherein a length of the MAC is greater than 30 bits.

8. The ECU ofclaim 6, wherein the vehicle bus is a controller area network (CAN) bus, a media oriented system transfer (MOST) bus, or a local area network (LAN).

9. The ECU ofclaim 6, wherein the MAC is located in a payload of the serial bus message.

10. The ECU ofclaim 6, wherein the ECU controls one or more vehicle systems.

Images